Vaneet Aggarwal, Lalitha Sankar, A. Robert Calderbank, and H. Vincent Poor. Department of .... in Section V, and we conclude in Section VI. II. CHANNEL ...
Information Secrecy from Multiple Eavesdroppers in Orthogonal Relay Channels Vaneet Aggarwal, Lalitha Sankar, A. Robert Calderbank, and H. Vincent Poor Department of Electrical Engineering Princeton University Princeton, NJ 08544 Email: {vaggarwa,lalitha,calderbk,poor}@princeton.edu
Abstract—The secrecy capacity of relay channels with orthogonal components is studied in the presence of additional passive eavesdropper nodes. The relay and destination receive signals from the source on two orthogonal channels such that the destination also receives transmissions from the relay on its channel. The eavesdropper(s) can overhear either one or both of the orthogonal channels. For a single eavesdropper node, the secrecy capacity is shown to be achieved by a partial decodeand-forward (PDF) scheme when the eavesdropper can overhear only one of the two orthogonal channels. For the case of two eavesdropper nodes, secrecy capacity is shown to be achieved by PDF for a sub-class of channels.
I. I NTRODUCTION In wireless networks for which nodes can benefit from cooperation and packet-forwarding, there is also a need to preserve the confidentiality of transmitted information from untrusted nodes. Information privacy in wireless networks has traditionally been the domain of the higher layers of the protocol stack via the use of cryptographically secure schemes. In his seminal paper on the three-node wiretap channel, Wyner showed that perfect secrecy of transmitted data from the source node can be achieved when the physical channel to the eavesdropper is noisier than the channel to the intended destination, i.e., when the channel is a degraded broadcast channel [1]. This work was later extended by Csisz´ar and K¨orner to all broadcast channels with confidential messages, in which the source node sends common information to both receivers and confidential information to one of the receivers [2]. Recently, the problem of secure communications has also been studied for a variety of multi-terminal networks; see for example, [3–10], and the references therein. In [11, 12], the authors show that a relay node can facilitate the transmission of confidential messages from the source to the destination in the presence of a wiretapper, often referred to as an eavesdropper in the wireless setting. The authors of [11] develop the rate-equivocation region for this four node relay-eavesdropper channel and introduce a noise forwarding scheme in which the relay, even if it is unable to aid the source in its transmissions, transmits codewords independently of the source to confuse the eavesdropper. In contrast, the relay channel with confidential messages in which the relay node acts as both a helper and eavesdropper is studied in [13]. In
these papers, the relay is assumed to be full-duplex, i.e., it can transmit and receive simultaneously over the entire bandwidth. In this paper, we study the secrecy capacity of a relay channel with orthogonal components in the presence of a passive eavesdropper node. The orthogonality comes from the fact that the relay and destination receive signals from the source on orthogonal channels; furthermore, the destination also receives transmissions from the relay on its (the destination’s) channel. The orthogonal model implicitly imposes a half-duplex transmission and reception constraint on the relay. For this channel, in the absence of an eavesdropper, El Gamal and Zahedi showed that a partial decode-and-forward (PDF) strategy in which the source transmits two messages on the two orthogonal channels and the relay decodes its received signal, achieves the capacity. Since the eavesdropper can receive signals from either orthogonal channel or both, three cases arise in the development of the secrecy capacity. We specialize the outer bounds developed in [11] for the orthogonal case and show that for a single eavesdropper node, PDF achieves the secrecy capacity for the two cases where the eavesdropper receives signals in only one of the two orthogonal channels. This is further extended to two eavesdroppers where the secrecy capacity is shown to be achieved for a sub-class of channels for which one of the eavesdroppers is more capable with respect to the other. In [14], the authors study the secrecy rate of the channel considered here under the assumption that the relay is colocated with the eavesdropper and the eavesdropper is completely cognizant of the transmit and receive signals at the relay. The authors found that using the relay does not increase the secrecy capacity and hence there is no security advantage to using the relay. In this paper, we consider the eavesdropper as a separate entity and show that using the relay increases the secrecy capacity in some cases. In the model of [14], the eavesdropper can overhear only on the channel to the relay while we consider three cases in which the eavesdropper can overhear on either or both of the channels. This is further extended to two eavesdroppers. The paper is organized as follows. In Section II, we present the channel models. In Section III, we develop the inner and outer bounds on the secrecy capacity when there is a
single eavesdropper. Section IV extends to the case of two eavesdropper nodes. We illustrate these results with examples in Section V, and we conclude in Section VI. II. C HANNEL M ODELS AND P RELIMINARIES A discrete-memoryless relay eavesdropper channel with two eavesdroppers is denoted by (X1 × X2 , p(y, y1 , y2 , y3 |x1 , x2 ), Y × Y1 × Y2 × Y3 ), such that the inputs to the channel in a given channel use are X1 ∈ X1 and X2 ∈ X2 at the source and relay, respectively, the outputs of the channel are Y1 ∈ Y1 , Y ∈ Y, Y2 ∈ Y2 , and Y3 ∈ Y3 at the relay, destination, first eavesdropper, and second eavesdropper, respectively, and the channel transition probability is given by pY Y1 Y2 Y3 |XX2 (y, y1 , y2 , y3 |x, x2 ). The channel is assumed to be memoryless, i.e. the channel outputs at time i depend only on channel inputs at time i. The source transmits a message W1 ∈ W1 = {1, 2, · · · , M } to the destination using an (M, n) code consisting of 1) a stochastic encoder f at the source such that f : W1 → X1n ∈ X1n , 2) a set of relay encoding functions fr,i : (Y1,1 , Y1,2 , · · · , Y1,i−1 ) → x2,i at every time instant i, and 3) a decoding function at the destination Φ : Y n → W1 . The average error probability of the code is defined as X 1 Pen = Pr{Φ(Y n ) 6= w1 |w1 was sent}. (1) M w1 ∈W1
Y
1
relay
X2 W1
XD p(y,y1,y2,y3|xR,xD,x2)
encoder
Y
Ù W1 decoder
XR
p(y, y1 , y2 , y3 |x1 , x2 ) =
p(y1 , y2,1 , y3,1 |xR , x2 ) · p(y, y2,2 , y3,2 |xD , x2 ).
Definition 1 assumes that the eavesdropper can receive signals in both channels. In general, the secrecy capacity bounds for this channel depend on the receiver capabilities of the eavesdroppers. To this end, we explicitly include the following two definitions for the cases in which each eavesdropper can receive signals in only one of the channels. Definition 2: The j th eavesdropper is limited to receiving signals on the channel from the source to the relay for j = 1, 2, if yj+1,2 = 0.
Y
3,1
Y
2,2
second eavesdropper Y3,2
first eavesdropper Y
2,1
Fig. 1.
The secrecy capacity is the maximum rate satisfying (2)-(5). The model described above considers a relay that transmits and receives simultaneously in the same orthogonal channel. Inner and outer bounds for this model for a single eavesdropper are developed in [11]. In this paper, we consider a relay eavesdropper channel with orthogonal components in which the relay receives and transmits in two orthogonal channels. The source transmits in both channels, one of which is received at the relay and the other at the destination. The relay transmits along with the source in the channel received at the destination. Thus, the source signal X1 consists of two parts XR ∈ XR and XD ∈ XD , transmitted to the relay and the destination, respectively, such that X1 = XD × XR . The eavesdroppers can receive transmissions in one or both orthogonal channels such that Y2,i ∈ Y2,i and Y3,i ∈ Y3,i denotes the received signal at the two eavesdroppers respectively in orthogonal channel i, i = 1, 2, where Y2 = Y2,1 × Y2,2 and Y3 = Y3,1 × Y3,2 . More formally, the relay eavesdropper channel with orthogonal components is defined as follows. Definition 1: A discrete-memoryless relay eavesdropper channel is said to have orthogonal components if the sender alphabet X1 = XD × XR and the channel can be expressed as
The relay-eavesdropper channel with orthogonal components.
The equivocation rate at the eavesdroppers is defined as n Re = (Re,1 , Re,2 ), where Re,i = n1 H(W1 |Yi+1 ) for i = 1, 2. A perfect secrecy rate of R1 is achieved if for any ² > 0, there exists a sequence of codes (M, n) and an integer N such that for all n ≥ N , we have 1 (2) R1 = log2 M, n Pen ≤ ², (3) 1 H(W1 |Y2 ) ≥ R1 − ² and (4) n 1 H(W1 |Y3 ) ≥ R1 − ². (5) n
(6)
Definition 3: The j th eavesdropper is limited to receiving signals on the channel from the source and the relay to the destination for j = 1, 2, if yj+1,1 = 0.
(7)
Remark 1: In the case of only one eavesdropper, y3,1 = y3,2 = 0. Thus, depending on the receiver capabilities of the eavesdroppers, there are three cases that arise for each eavesdropper in developing the secrecy capacity bounds. First, we consider a single eavesdropper. For brevity, for a single eavesdropper, we henceforth identify the three cases as cases 1, 2, and 3, where cases 1 and 2 correspond to Definitions 2 and 3, respectively, and case 3 is the general case where the eavesdropper receives signals from both channels. For two eavesdroppers, a total of nine cases result from all possible combinations of receiver capabilities at each eavesdropper. We denote these cases by Case (i, j) for i, j = 1, 2, 3 where i denotes the receiver
capability for eavesdropper 1 while j denotes the receiver capabilities for receiver 2. We use the standard notation for entropy and mutual information [15] and take all logarithms to the base 2 so that our rate units are bits. We also write random variables with uppercase letters (e.g. Wk ) and their realizations with the corresponding lowercase letters (e.g. wk ). We drop subscripts on probability distributions if the arguments are lowercase versions of the corresponding random variables. Finally, for brevity, we henceforth refer to the channel studied here as the orthogonal relay eavesdropper channel. III. S INGLE E AVESDROPPER : O UTER AND I NNER B OUNDS In this section, we give outer and inner bounds for the secrecy capacity of the discrete-memoryless orthogonal relay eavesdropper channel. The following theorems summarize the outer and inner bounds as well as the secrecy capacity results for the three cases in which the eavesdropper can receive in either one or both orthogonal channels. Detailed proofs and illustrations can be found in [16]. Theorem 1: An outer bound on the secrecy capacity of the relay eavesdropper channel with orthogonal components is given by Case 1 :
Cs ≤
Case 2 :
Cs ≤
Case 3 :
Cs ≤
max[min{I(VD VR ; Y Y1 |V2 U ), I(VD V2 ; Y |U )} − I(VR ; Y2 |U )]+ max[min{I(VD VR ; Y Y1 |V2 U ), I(VD V2 ; Y |U )} − I(VD V2 ; Y2 |U )]+ max[min{I(VD VR ; Y Y1 |V2 U ), I(VD V2 ; Y |U )} − I(VR VD V2 ; Y2 |U )]+
where the maximum is over all joint distributions satisfying the Markov chain condition U → (VR , VD , V2 ) → (XR , XD , X2 ) → (Y, Y1 , Y2 ).1 For a relay channel with orthogonal components, the authors of [17] show that a strategy where the source uses each channel to send an independent message and the relay decodes the message transmitted in its channel, achieves capacity. Due to the fact that the relay has partial access to the source transmissions, this strategy is sometimes also referred to as partial decode and forward [18]. The achievable scheme involves block Markov superposition encoding while the converse is developed using the max-flow, min-cut bounds. A natural question for the relay-eavesdropper channel with orthogonal components is whether the PDF strategy can achieve the secrecy capacity. To this end, we summarize the achievable PDF secrecy rates for the three cases. Theorem 2: An inner bound on the secrecy capacity of the orthogonal relay eavesdropper channel, achieved using partial decode and forward over all input distributions of the form 1 The
notation [x]+ denotes max(x, 0).
p(xR , xD , x2 ), is given by Case 1 :
Cs ≥
Case 2 :
Cs ≥
Case 3 :
Cs ≥
min{I(XD XR ; Y Y1 |X2 ), I(XD X2 ; Y )} −I(XR ; Y2 ) (8) min{I(XD XR ; Y Y1 |X2 ), I(XD X2 ; Y )} −I(XD , X2 ; Y2 ) (9) min{I(XD XR ; Y Y1 |X2 ), I(XD X2 ; Y )} −I(XR ; Y2 |X2 ) − I(XD , X2 ; Y2 ) (10)
The bounds in (10) can be generalized by randomizing the channel inputs. The following theorem summarizes our result that PDF with randomization achieves the secrecy capacity when the eavesdropper is limited to receiving signals on one of the two channels. Theorem 3: The secrecy capacity of the relay channel with orthogonal complements is Case 1 :
Cs =
Case 2 :
Cs =
Case 3 :
Cs ≤
max[min{I(VD VR ; Y Y1 |V2 U ), I(VD V2 ; Y |U )} − I(VR ; Y2 |U )]+ max[min{I(VD VR ; Y Y1 |V2 U ), I(VD V2 ; Y |U )} − I(VD V2 ; Y2 |U )]+ max[min{I(VD VR ; Y Y1 |V2 U ), I(VD V2 ; Y |U )} − I(VR VD V2 ; Y2 |U )]+
where the maximum is over all joint distributions satisfying U → (VR , VD , V2 ) → (XR , XD , X2 ) → (Y, Y1 , Y2 ). Furthermore, for Case 3, Cs ≥
[min{I(VD VR ; Y Y1 |V2 U ), I(VD V2 ; Y |U )} −I(VR ; Y2 |V2 U ) − I(VD , V2 ; Y2 |U )]+
for all joint distributions satisfying U → (VR , VD , V2 ) → (XR , XD , X2 ) → (Y, Y1 , Y2 ). Remark 2: In contrast to the non secrecy case, where the orthogonal channel model simplifies the cut-set bounds to match the inner PDF bounds, for the orthogonal relay-eavesdropper model in which the eavesdropper receives in both channels, i.e., when the orthogonal receiver restrictions at the relay and intended destination do not apply to the eavesdropper, in general, the outer bound can be strictly larger than the inner PDF bound. IV. T WO E AVESDROPPERS In this section, we will consider the achievable secrecy rates in the presence of two eavesdroppers. Let 1E1,1 , 1E1,2 , and 1E1,3 denote the indicator functions for the first eavesdropper being in case 1, 2, and 3, respectively. Similarly suppose that 1E2,1 , 1E2,2 , and 1E2,3 denote the indicator functions for the second eavesdropper being in case 1, 2, and 3 respectively. The following theorem summarizes the rates achievable by PDF in cases (i, j), i, j = 1, 2, 3. Theorem 4: An inner bound on the secrecy capacity of the orthogonal relay eavesdropper channel with two eavesdroppers, achieved using partial decode and forward over all input
distributions of the form p(xR , xD , x2 ), is given by Cs ≥ min{I(XD XR ; Y Y1 |X2 ), I(XD X2 ; Y )} − max{I(XR ; Y2 )1E1,1 + I(XD X2 ; Y2 )1E1,2 +I(XD X2 ; Y2 )1E1,3 + I(XR ; Y2 |X2 )1E1,3 , I(XR ; Y3 )1E2,1 + I(XD X2 ; Y3 )1E2,2 +I(XD X2 ; Y3 )1E2,3 + I(XR ; Y3 |X2 )1E2,3 }(11) The next theorems describe some special cases in which the secrecy capacity is achieved by PDF. Theorem 5: If ≤
I(VR ; Y2 |U )1E1,1 + I(VD V2 ; Y2 |U )1E1,2 I(VR ; Y3 |U )1E2,1 + I(VD V2 ; Y3 |U )1E2,2 , (12)
for all joint distributions satisfying U → (VR , VD , V2 ) → (XR , XD , X2 ) → (Y, Y1 , Y2 , Y3 ), then the secrecy capacity in Case (i, j) for i, j ∈ {1, 2} is Cs =
max[min{I(VD VR ; Y Y1 |V2 U ), I(VD V2 ; Y |U )} −I(VR ; Y3 |U )1E2,1 − I(VD V2 ; Y3 |U )1E2,2 ]+ (13)
where the maximum is over all joint distributions satisfying U → (VR , VD , V2 ) → (XR , XD , X2 ) → (Y, Y1 , Y2 ). Proof: As with the single eavesdropper, the PDF rates in Theorem 4 can be generalized by randomization of the channel inputs. Since the maximum secrecy rate that can be achieved with one eavesdropper is at least as much as can be achieved with two eavesdroppers, an outer bound for this channel can be obtained by considering only one eavesdropper. Thus, from Theorem 1, (13) is also an upper bound. Remark 3: Theorem 5 allows a comparison of the eavesdropper capabilities for cases where each eavesdropper has access to only one of the two orthogonal channels. V. E XAMPLES In this section, we consider two examples, the first with one eavesdropper and the second with two eavesdroppers. Y1
X2 a1
XR
b1
aR
Y
bR
Y2,2
aD XD
Fig. 2.
Y2,1
Orthogonal relay eavesdropper channel model of Example 1.
Example 1: Consider an orthogonal relay eavesdropper channel where the input and output signals at the source,
relay, and destination are binary two-tuples while Y2,1 and Y2,2 at the eavesdropper are binary alphabets. We write XR = (aR , bR ), XD = aD and X2 = (a1 , b1 ) to denote the vector binary signals at the source and the relay. The outputs at the relay, destination and the eavesdropper are also vector binary signals given by Y = (a1 , aD ), Y1 = (aR , bR ), Y2,1 = (bR ) and Y2,2 = (b1 ⊕ aD ),
(14) (15) (16) (17)
as shown in Figure 2. The capacity of this channel is also at most 2 bits per channel use. We now show that a secrecy capacity of 2 bits per channel use can be achieved for this example. Consider the following coding scheme: in the ith use of the channel, the source encodes 2 bits, denoted as w1,i and w2,i , as XR = (w1,i , 0),
XD = (w2,i ).
The relay receives w1,i−1 in the previous use of the channel. Furthermore, in each channel use, it also generates a uniformly random bit ni , and transmits X2 = (w1,i−1 , ni ).
(18)
With these transmitted signals, the received signals at the receiver and the eavesdropper are Y = (w1,i−1 , w2,i ), Y2,1 = (0) and Y2,2 = (ni ⊕ w2,i ).
(19) (20) (21)
Thus, over n + 1 uses of the channel the destination receives all 2n + 1 bits transmitted by the source. On the other hand, in every use of the channel, the eavesdropper cannot decode either source bit. In the above example, we see that the secrecy capacity was achieved by the relay transmitting a part of the message as well as a random signal. Example 2: Consider an orthogonal relay eavesdropper channel with XR = XD = X2 = {0, 1}. We write XR = aR , XD = aD and X2 = a1 ,
(22) (23) (24)
to denote the binary signals at the source and the relay. The outputs at the relay, destination and the eavesdropper are also binary signals given by Y = a1 ⊕ aD ,
(25)
Y 1 = aR , Y2,1 = aR ,
(26) (27)
Y2,2 = 0, Y3,1 = 0 and
(28) (29)
Y3,2 = aD ,
(30)
as shown in Figure 3. The capacity of this channel is at most 1 bit per channel use. We now show that a secrecy capacity of 1 bit per channel use can be achieved for this example. Consider the following coding scheme: in the ith use of the channel, the source generates a uniformly random bit ni and encodes 1 bit, denoted as wi , as XR = ni
and
XD = wi + ni−1 .
ACKNOWLEDGEMENT
The relay receives ni−1 in the previous use of the channel X2 Y1
XR
a1
aR
Y3,2
D
X
D
Y
2,1
Fig. 3.
Orthogonal relay eavesdropper channel model of Example 2.
which it transmits, and thus X2 = ni−1 .
(31)
With these transmitted signals, the received signals at the receiver and the eavesdroppers are Y Y2,1 Y2,2 Y3,1 Y3,2
= wi , = ni , = 0, = 0 and = wi + ni−1 .
The work of V. Aggarwal and A. R. Calderbank was supported in part by NSF under grant 0701226, by ONR under grant N00173-06-1-G006, and by AFOSR under grant FA9550-05-1-0443. The work of L. Sankar and H. V. Poor was supported in part by the National Science Foundation under grant CNS-06-25637. R EFERENCES
Y
a
or both of the two orthogonal channels that the source uses for its transmissions. If there is a single eavesdropper node which is restricted to receiving in only one of the two channels, we have shown that the secrecy capacity is achieved by a partial decode-and-forward strategy. This is further extended to two eavesdroppers where the secrecy capacity is achieved by PDF for a subclass of channels.
(32) (33) (34) (35) (36)
Thus, over n+1 uses of the channel the destination receives all n bits transmitted by the source. On the other hand, in every use of the channel, any of the eavesdropper cannot decode either source bit. In the above example, we see that the two eavesdroppers are limited to receiving signals on two different channels. If they do not cooperate, we get a secrecy capacity of 1. However, if both the eavesdropper cooperate, it is equivalent to one eavesdropper listening to both channels. In this case, the combined eavesdropper knows whatever the source transmits and hence we cannot get a positive secrecy capacity. VI. C ONCLUSIONS We have developed bounds on the secrecy capacity of relay eavesdropper channels with orthogonal components in the presence of additional passive eavesdroppers. Our results depend on the capability of the eavesdropper to overhear either
[1] A. Wyner, “The wire-tap channel,” Bell Syst. Tech. J., vol. 54, no. 8, pp. 1355–1387, 1975. [2] I. Csisz´ar and J. K¨orner, “Broadcast channels with confidential messages,” IEEE Trans. Inform. Theory, vol. 24, no. 3, pp. 339–348, May 1978. [3] E. Tekin and A. Yener, “The general Gaussian multiple access and two-way wire-tap channels: Achievable rates and cooperative jamming,” arXiv, vol. abs/cs/0702112, 2007. [4] A. Khisti and G. W. Wornell, “The MIMOME channel,” in Proc. 45th Annual Allerton Conf. Comm., Contr. and Computing, Monticello, IL, Sep. 2007. [5] T. Lie and S. Shamai, “A channel-enhancement approach to the secrecy capacity of the multi-antenna wiretap channel,” 2007, preprint. [6] F. Oggier and B. Hassibi, “The secrecy capacity of the MIMO wiretap channel,” 2007, preprint. [7] M. Bloch and A. Thangaraj, “Confidential messages to a cooperative relay,” in Proc. IEEE Information Theory Workshop, Porto, Portugal, May 2008, pp. 154–158. [8] Y. Liang and H. V. Poor, “Multiple-access channels with confidential messages,” IEEE Trans. Inform. Theory, vol. 54, no. 3, pp. 976–1002, March 2008. [9] Y. Liang, H. V. Poor, and S. Shamai, “Secure communication over fading channels,” IEEE Trans. Inform. Theory, vol. 54, no. 6, pp. 2470–2492, June 2008. [10] Y. Liang, A. Somekh-Baruch, H. V. Poor, S. Shamai, and S. Verd´u, “Capacity of cognitive interference channels with and without secrecy,” IEEE Trans. Inform. Theory, vol. 55, no. 2, Feb. 2009, to appear. [11] L. Lai and H. El Gamal, “The relay-eavesdropper channel: cooperation for secrecy,” IEEE Trans. Inform. Theory, vol. 54, no. 9, pp. 4005–4019, Sep. 2008. [12] M. Yuksel and E. Erkip, “The relay channel with a wire-tapper,” in Proc. 41st Annual Conference on Information Sciences and Systems, Baltimore, Mar 2007. [13] Y. Oohama, “Relay channels with confidential messages,” arXiv, vol. abs/cs/0611125, 2006. [14] X. He and A. Yener, “On the equivocation region of relay channels with orthogonal components,” in Proc. 41st Annual Asilomar Conf. Signals, Systems, and Computers, Pacific Grove, CA, Nov. 2007. [15] T. M. Cover and J. A. Thomas, Elements of Information Theory. John Wiley and Sons, Inc., New York, 1991. [16] V. Aggarwal, L. Sankar, A. R. Calderbank, and H. V. Poor, “Secrecy capacity of a class of orthogonal relay eavesdropper channels,” Submitted to Eurasip J. Wireless Communications and Networking - Special Issue on Wireless Physical Layer Security, Dec. 2008. [17] A. El Gamal and S. Zahedi, “Capacity of relay channels with orthogonal components,” IEEE Trans. Inform. Theory, vol. 51, no. 5, pp. 1815– 1817, May 2005. [18] G. Kramer, “Models and theory for relay channels with receive constraints,” in Proc. 42nd Annual Allerton Conf. on Commun., Control, and Computing, Monticello, IL, Sep. 2004.
